All of keywords logic

[frack113]

from Lists combined with "all of" parsing in unexpected way

When we use all of keywords in condition it is to search all the string of the list with an AND whitout fieldname.
But is a mix of modifer in the condition.

A way can be to have a generic field name and use the |all.
Backend should say this reserved name is not a field name but a ubound search.

[nasbench]

The rules are written in a way that's to my knowledge allowed in SIGMAC. So they should be fine.

If the behavior is deprecated in PySIGMA (for some reason). We will treat them in a similar way to the rules using correlations (pipe, near...etc.). This means once PySIGMA is prod and SIGMAC is deprecated we will modify the rules to use the new syntax.

But for now, I think this should be solved in PySIGMA. Either we convert them in a similar way to SIGMAC or we put up a warning.

[thomaspatzke]

I fear that if this is changed in pySigma then this edge-case is continued to be used in this way. I prefer to change this in sigmac with a deprecation warning and implement the error-behavior described in my other response for pySigma. Further, all rules using this should be changed that they use the all modifier. Such, only private repositories will be affected and warned with new sigmac versions about the upcoming change.

[thomaspatzke]

all of was originally intended to control the boolean linking of detection definitions while it was intended to control the linking of detection items in lists with the all modifier. IMO it is cleaner to have a clear distinction between both use cases than letting all of behave differently in a certain special case. Furthermore it gets really messy if all of keyword* is used with multiple keyword detection definitions. There are then two ways to interpret this:

• all keywords from all detection definitions are AND-linked.
• the keywords from each referenced detection definition are OR-linked and the detection definitions themselves are AND-linked.

This can be really confusing for rule writers because the behavior could be contradictory to their expectations, even when we decide on one and specify this.

It is possible to use |all without a field name, which results in an AND-linked keyword list. Therefore, I prefer to deprecate this sigmac behavior and have this clear semantic distinction.

To make the whole thing consistent I propose the distinction mentioned above and to make it an error case when all of and any of refer to a single identifier without a wildcard or them in the reference. The error message should then be some kind of "You likely wanted to AND-link the items of detection x, please use the all modifier to accomplish this.".

[nasbench]

Fair. Sounds good to me. I mean the confusion happened to me as well once so I understand it. I think your proposition is good and we should go with it.

• Transform the rule that uses the "all of keywords" -> into using the"|all"
• Show a future warning of deprecation and the suggestion to use the correct modifier.